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DATA PROTECTION ACT 1998 
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


Bizfella Limited 


Metropolitan House, Station Road, Cheadle Hulme, Cheadle, Cheshire, 
England, SK8 7AZ 


The Information Commissioner (“the Commissioner”) has decided to 
issue Bizfella Limited (“Bizfella”) with an enforcement notice under 
section 40 of the Data Protection Act 1998 (“DPA”). The notice is being 
issued because of a serious contravention of Regulation 22 of the Privacy 
and Electronic Communications (EC Directive) Regulations 2003 
(“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


Bizfella, whose registered office is given above (Companies House 
Registration Number: 09219302) is the organisation stated in this notice 
to have instigated the transmission of communications by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 


® 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 
recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing (free 
of charge except for the costs of the transmission of the 
refusal) the use of his contact details for the purposes of such 
direct marketing, at the time that the details were initially 
collected, and, where he did not initially refuse the use of the 


details, at the time of each subsequent communication. 


(4) A subscriber shall not permit his line to be used in contravention of 
paragraph (2).” 
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Section 122(5) of the Data Protection Act 2018 “DPA18” defines direct 
marketing as “the communication (by whatever means) of any 
advertising material which is directed to particular individuals”. This 


definition also applies for the purposes of PECR (see regulation 2(2) PECR 
and paragraphs 430 & 432(6) to Schedule 19 of the DPA18). 


‘Consent’ for PECR purposes is now defined, from 29 March 2019, by 
reference to the concept of consent in Regulation 2016/679 (“the 
GDPR”): regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. Article 
4(11) of the GDPR sets out the following definition: “'consent’ of the data 
subject means any freely given, specific, informed and unambiguous 
indication of the data subject's wishes by which he or she, by a statement 
or by a clear affirmative action, signifies agreement to the processing of 
personal data relating to him or her”. 


Recital 32 of the GDPR materially states that “When the processing has 
multiple purposes, consent should be given for all of them”. Recital 42 
materially provides that “For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 


processing operations despite it being appropriate in the individual case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic communications 


services for the supply of such services”. 
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“Electronic mail” is defined in regulation 2(1) of PECR as “any text, voice, 
sound or image message sent over a public electronic communications 
network which can be stored in the network or in the recipient’s terminal 
equipment until it is collected by the recipient and includes messages 


sent using a short message service”. 


The term "soft opt-in" is used to describe the rule set out in in Regulation 
22(3) of PECR. In essence, an organisation may be able to e-mail its 
existing customers even if they haven't specifically consented to 
electronic mail. The soft opt-in rule can only be relied upon by the 


organisation that collected the contact details. 


The DPA contains enforcement provisions at Part V which are exercisable 
by the Commissioner. Those provisions are modified and extended for 
the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, he may serve him with an Enforcement Notice requiring him 
to take within such time as may be specified in the Notice, or to refrain 
from taking after such time as may be so specified, such steps as are so 


specified. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ overall 


aim of ensuring high levels of protection for individuals’ privacy rights. 
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The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


The contravention 


The Commissioner finds that Bizfella contravened regulation 22 PECR. 


The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 15 November 2019 to 15 July 
2020 there transmitted 224,550 direct marketing SMS messages 


received by subscribers contrary to regulation 22 of PECR. 


Bizfella is required to ensure that it is acting in compliance with the 
requirements of regulation 22 of PECR, and to ensure that valid consent 
was obtained, or that the soft opt-in requirements were met, to send 
those messages has been acquired. 


For consent to be valid it is required to be “freely given”, by which it 
follows that if consent to marketing is a condition of subscribing to a 
service, the organisation will have to demonstrate how the consent can 


be said to have been given freely. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 


organisation, that will be sending it. 


Consent will not be “informed” if individuals do not understand what they 
are consenting to. Organisations should therefore always ensure that the 
language used is clear, easy to understand, and not hidden away in a 


privacy policy or small print. Consent will not be valid if individuals are 
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asked to agree to receive marketing from “similar organisations”, 


HO 


“partners”, “selected third parties” or other similar generic description. 


Bizfella is an FCA registered credit broker that trades under various 
names including Cash Carrot and Pixie Loans. As part of its business, 
Bizfella operates a number of websites including a Cash Carrot website 


and a Pixie Loans website. 


Individuals can submit loan applications on the websites operated by 
Bizfella (including the Cash Carrot and Pixie Loans websites) which 
applications are then passed to Bizfella’s panel of lenders to be approved 


or declined. 


Individuals made loan applications through one or more of the websites 
operated by Bizfella including the Cash Carrot website and the Pixie 
Loans website. Bizfella subsequently sent or arranged to be sent an SMS 
message to inform the relevant individual of the outcome of the loan 
application. That first text message can properly be said to be solicited. 
However, following the initial SMS message, Bizfella then instigated the 
sending of direct marketing messages to those individuals, for up to the 
next two years, to encourage them to again apply for a loan through the 
Cash Carrot website. Such direct marketing messages could only be 
lawfully sent if consent had been given for the same or the soft opt-in 


rule was satisfied. 


Bizfella relied on a statement and tick box that was included on the Cash 
Carrot and Pixie Loans websites at the time that the individuals applied 
for the initial loan as constituting consent and/or satisfying the soft opt- 


in rule. That statement provided: 


“By submitting your information, you confirm that you provided 


accurate financial information and considered potential future 
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income and outgoings in determining your ability to repay. Ticking 
this box also indicates that you have read, understand, and agree 
to the terms of our Privacy Policy and Terms & Conditions of Use, 
and authorize your information to be shared with select lending 
partners, credit brokers and financial savings products, and for 
them to contact you by SMS, email and automated voice 


messaging in relation to the applications. 


u- a combine, analyse and profile my 


information and pass their knowledge on to other organisations for 
the purposes of tracing, providing important information. or 
returning assets to me. Your data may also be used for debt 
recovery, fraud prevention, to support the assessment of credit 
risk, pricing and affordable payments. If you do not want your data 
to be used in this way please click here.” 


Individuals could only proceed to submit their loan application if they 


ticked the box signifying acceptance of the above statement. 


The Commissioner has considered the “consents” obtained and, for the 
reasons explained below, is concerned that in each case there are issues 
as to whether the consents can be said to have been freely given, specific 
and informed. The Commissioner is also concerned that the soft opt-in 


rule was not satisfied. 


Valid consent requires an individual to be given real choice and control. 
The statement on the Cash Carrot and Pixie Loans websites did not give 
the individuals any meaningful option but to tick the box signifying 
acceptance as, in the absence of so doing, the individuals could not 


submit their loan applications. 
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Further and in any event, the statement on the websites referred to 
contact “in relation to the applications”. The subsequent SMS messages 
sent to the individuals did not relate to the loan application that they had 
submitted but instead were sent to encourage those individuals to make 
further loan applications. Further, the statement did not sufficiently 
inform the individuals that they would receive marketing messages or 


ask them whether they wanted to receive marketing messages. 


The soft opt-in rule requires the individual to have been given a simple 
means of refusing the use of his contact details. However, the statement 
on the websites did not give the individuals any meaningful option but 
to tick the box signifying acceptance as, in the absence of so doing, the 
individuals could not submit their loan applications. Nor was there any 


other simple means of refusing the use of their contact details. 


The Commissioner is therefore satisfied from the evidence he has seen 
that Bizfella did not have the necessary valid consent and the soft opt- 
in rule was not satisfied in relation to the 224,550 direct marketing 


messages received by subscribers. 


The Commissioner has considered, as he is required to do under section 
40(2) of the DPA (as extended and modified by PECR) when deciding 
whether to serve an Enforcement Notice, whether any contravention has 
caused or is likely to cause any person damage or distress. The 
Commissioner has decided that it is unlikely that damage or distress has 


been caused in this instance. 


In view of the matters referred to above the Commissioner 
hereby gives notice that, in exercise of his powers under 
section 40 of the DPA, he requires Bizfella to take the steps 


specified in Annex 1 of this Notice. 


Information Commissioner's Office 


35. There is a right of appeal against this Notice to the First-tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. 


Information about appeals is set out in the attached Annex 2. 


Dated 6 April 2022 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 


ICO. 


Information Commissioner's Office 


ANNEX 1 


TERMS OF THE ENFORCEMENT NOTICE 


Bizfella shall within 30 days of the date of this notice: 


Except in the circumstances referred to in paragraph (3) of 
regulation 22 of PECR, neither transmit, nor instigate the 
transmission of, unsolicited communications for the purposes of 
direct marketing by means of electronic mail unless the recipient of 
the electronic mail has previously notified Bizfella that he clearly and 
specifically consents for the time being to such communications 


being sent by, or at the instigation of, Bizfella. 


Where consent is relied on for the transmission of unsolicited 
communications for the purposes of direct marketing by means of 


electronic mail, ensure that: 


o Such consent is not made a pre-condition of service. 

o The consent statement is kept separate and distinct from other 
terms and conditions. 

o The consent statement specifies why the data is being obtained 
and what will be done with the data, including that it will be used 
for marketing purposes in relation to other loan applications. 

o The consent statement names Bizfella and any third party 


controllers who will be relying on the consent. 
Where the soft-opt put rule is relied on for the transmission of 


unsolicited communications for the purposes of direct marketing by 


means of electronic mail, ensure individuals are given the option to 
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opt out of receiving marketing at the point when their details are 


collected. 
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ANNEX 2 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 
accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that he ought to have exercised his discretion 


differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


e The notice of appeal should be served on the Tribunal within 28 


days of the date on which the enforcement notice was sent 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 


